CVE-2026-84793
Received Received - Intake

Stored XSS in Craft CMS Control Panel via Site Name Field

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: VulnCheck

Description
Craft CMS versions from 5.0.0-RC1 before 5.10.11 contain a stored cross-site scripting vulnerability in the site name field that fails to sanitize input. Administrators can inject arbitrary JavaScript payloads in the site name that execute when other users view the control panel settings pages.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-84793
EUVD
EUVD-2026-69905

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
craft_cms craft_cms to 5.10.11 (exc)
craftcms cms to 5.10.11 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in Craft CMS versions 5.0.0-RC1 to 5.10.10. The site name field fails to sanitize input, allowing administrators with specific permissions to inject malicious JavaScript payloads. These payloads execute when other users view control panel settings pages.

Detection Guidance

Check Craft CMS version with: composer show craftcms/cms. If version is between 5.0.0-RC1 and 5.10.10, the system is vulnerable. Inspect site name field in control panel settings for unusual JavaScript code or payloads.

Impact Analysis

An attacker with administrator privileges could inject JavaScript that executes in the browsers of other users viewing the control panel. This could lead to session hijacking, data theft, or unauthorized actions performed on behalf of users.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR (data protection) and HIPAA (health information privacy) requirements. Organizations may face compliance penalties if user data is compromised through such attacks.

Mitigation Strategies

Upgrade Craft CMS to version 5.10.11 or later immediately. Disable the 'allowAdminChanges' setting if not required. Review site name field for injected scripts and remove any suspicious content.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84793. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart